1. TFA : A Tunable Finite Automaton for Regular Expression Matching Author: Yang Xu, Junchen Jiang, Rihua Wei, Tang Song and H. Jonathan Chao Publisher: Technical Report Presenter: Ye-Zhi Chen Date: 2013/04/17

2. Introduction The main contributions in this paper : 1. We introduce TFA, the first finite automaton model with a clear and tunable bound on the number of concurrent active states (more than one) independent of the number and patterns of regular expressions. 2. A mathematical model is built to analyze the set split problem (SSP) 3. We develop a novel state encoding scheme to facilitate the implementation of a TFA. 4. The proposed TFA is evaluated using regular expression sets from Snort and Bro.

3. Introduction This paper proposed a new finite automaton TFA, the first finite automaton model with a clear and tunable bound on the number of concurrent active states (more than one) independent of the number and patterns of regular expressions.

4. Motivation Patterns : 1..*a.*b[ˆa]*c 2..*d.*e[ˆd]*f 3..*g.*h[ˆg]*i Alphaset Σ ={a, b,..., i} Number of state in DFA :54 Number of state in NFA :10 the NFA requires much less memory, its memory bandwidth requirement is four times that of the DFA

5. Motivation

7. We have seen the main reason for the DFA having far more states than the corresponding NFA is that the DFA needs one state for each NFA active state combination One possible solution is to allow multiple automaton states (bounded by a given bound factor b) to represent each combination of NFA active states. We name it Tunable Finite Automaton (TFA). N T : the number of TFA states P : the number of all possible statuses that can be represented by at most b active states A TFA with N T = O (log b (N D ) ) states can represent a DFA with N D states

8. TUNABLE FINITE AUTOMMATON(TFA) Definition : A b-TFA is a 6-tuple A finite set of TFA states Q T ; A finite set of input symbols Σ; A transition function δ T : Q T × Σ→ P(Q N ); A set of initial states I ⊆ Q T, |I| ≤ b; A set of accept states F T ⊆ Q T ; A set split function SS : Q D → (Q T ) b ∪... ∪ (Q T ) 1.

9. Constructing A TFA The implementation of a TFA logically consists of two components : 1. A TFA structure 2. Set Split Table (SST) : Each entry of the SST table corresponds to one combination of NFA active states (i.e., a DFA state) recording how to split the combination into multiple TFA states

10. TFA

11. Constructing A TFA

12. Generating a equivalent b-TFA from an NFA consists of four steps: 1. Generate the DFA states using the subset construction scheme 2. Split each NFA active state combination into up to b subsets. After this step, we obtain the TFA state set Q T and the set split function SS; 3. Decide the transition function δ T. Outgoing transitions of TFA states point to a data structure called state label, which contains a set of NFA state IDs. 4. Decide the set of initial states (I) and the set of accept states (F T )

13. Constructing A TFA

14. Operating A TFA assume the input string is “adegf ”. Initial active state : O 1. a : return label {A,O}, next active states : OA 2. d : return label {A,D,O}, next active states :O, AD 3. e : return label {A,E,O}, next active states :O, AE 4. g : return label {A,E,G,O}, next active states :OG, AE 5. f : return label {A,F,G,O}, next active states :OG, AF 6. AF is an accept state => match!

15. Operating A TFA

16. Splitting NFA Active State Combinations Set Split Problem (SSP) : Find a minimal number of subsets from the NFA state set, so that for any valid NFA active state combination, we can always find up to b subsets to exactly cover it b-SSP problem is an NP-hard problem for any b > 1

17. Splitting NFA Active State Combinations

18. A Heuristic Algorithm for SSP Problem To simplify the problem, we add another constraint on the model of the b-SSP problem :

19. State Encoding Original : using an array to store state labels which include different numbers of NFA state IDs Problem : 1.High storage cost 2.TDA operation overhead : a)Redundancy elimination b)Sorting Solution : bit vector

20. Performance Evaluation